Accounting
All user activities are recorded
What are goals of accounting
Audit Trail, Regulatory Compliance, Forensic Analysis, Resource Optimizations, User Accountability
What actions should be tracked
Logging into the system, accessing files, modifying configuration, downloading or installing software, attempting unauthorized actions on systems and networks
Audit Trail
Chronological record of user activities
Forensic Analysis
Help cybersecurity specialists understand what happened, how it happened and how to prevent in future
What is used for it?
Syslog servers, Network analysis tools, SIEMs
What is SIEM?
Security Information and Event Management Systems
Syslog Servers
Used to aggregate logs from various network devices and systems so that system administrators can analyze them to detect patterns or anomalies in the organization’s systems
Network Analyzers
Like Wireshark. Used to capture and analyze network traffic to gain detailed insights into all the data moving within a network
SIEMs (what are used for)?
Real-time analysis of security alerts generated by various hardware and software infrastructures in organization
